I can see why Google might want to downplay this. Partner websites could obtain the history info directly from users and Google would not need to disclose the data sharing. I'm sure the watchlists/history would be valuable tools for profiling and advertising purposes.
The embedded YouTube player told me what you were watching
61–70 of 112 posts
Re: The embedded YouTube player told me what you were watching
#62Earlier quoted context omitted.
>can't understand generics Is this really true? We learned about generics in college so I assumed that everyone knew it (especially if they work at Google).
As someone else noted, I am taking a swing at Go's lack of generics. More to the point, I am criticizing the reason for that. Designing a simple language is fine. I like simple languages a lot. Go was designed not because simple languages are good for some jobs but because Google decided their engineers aren't up to using more powerful tools. I don't know Go. I've only written about 200 lines of it. I don't pretend t…
/Google decided their engineers aren't up to using more powerful tools./
I think you fundamentally misunderstand the reason for using Go. It's NOT about whether a developer is/isn't capable of understanding how to write code with a particular set of tools.
Instead, it's almost entirely about making that code simple to read and understand at a later date. Complex/'powerful' language tools complicate reading, which slows down later fixes and small modifications at best, and at worst leads to additional bugs in later iterations over the code. Thus, the core belief in Go's design is that 'powerful' languages are optimizing for entirely the wrong things.
From my perspective, this is a good change of focus. I want simple tools that I don't have to worry about. We have finite attention, so we should actively try to reduce cognitive load whenever possible, as it frees up attention for other things. For example, it's a much better use of my time to think about bayesian optimization than whether an array pointer is being safely handled... If I need to worry less about the latter, I have more time to think about the former.
Re: The embedded YouTube player told me what you were watching
#63$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.
That's barely worthy the time to create a proof of concept and write up the bug, let alone all the time spent understanding and finding it in the first place. A full time engineer costs Google more than that each day.
Re: The embedded YouTube player told me what you were watching
#64$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.
Bug bounties are ridiculous. If you disclose in an “irresponsible” way you’d get shamed here on HN, and yet we almost never talk about how pitiful the rewards are for “responsible” disclosure (maybe nothing or even legal trouble!).
The bounties can actually be rather good. This one just seems disproportionately low.
Re: The embedded YouTube player told me what you were watching
#65Re: The embedded YouTube player told me what you were watching
#66Earlier quoted context omitted.
It's an ageist way of saying that this exploit is less critical for people who take proactive counter-measures, and more affects less technically inclined or security-minded people.
Ageist how? Who says you have to be a certain age to be a parent or grandparent? Sounds very ageist to me. And that is an example of how political correctness is an arms race.
Don't be obtuse.
Re: The embedded YouTube player told me what you were watching
#67I honestly feel like Google's award in this case is pathetic. This is an exploit which would be worth 100s of thousands, if not millions to the wrong people.
Re: The embedded YouTube player told me what you were watching
#68Re: The embedded YouTube player told me what you were watching
#69Its too bad (in a way...) they couldn't get private video IDs to leak. It would have made an impressive combination with their bug posted earlier this month (Stealing Your Private Youtube Videos, One Frame at a Time https://news.ycombinator.com/item?id=25728175)
Speaking of... do security researchers sometimes just sit on their discoveries in hopes that they will eventually lead to a bigger payout? I would be kicking myself if I had reported a bug for a relatively small reward that I could have leveraged in combination with another discovery
Re: The embedded YouTube player told me what you were watching
#70I honestly feel like Google's award in this case is pathetic. This is an exploit which would be worth 100s of thousands, if not millions to the wrong people.
There is no entity that would pay anywhere near that amount of money for this. This is useless to black hats, and of course no legitimate service could pay to exploit this flaw. The last remotely plausible actor is like, various espionage agencies but good luck with that one.